EtwTraceFreezeThawProcess

VOID __stdcall EtwTraceFreezeThawProcess(_EPROCESS *Process, UINT8 Freeze){
  EVENT_DESCRIPTOR *v3; 
  UINT64 Flag; 
  int v5; 
  EVENT_DATA_DESCRIPTOR EventData; 
  __int64 v7; 
  int v8; 
  int v9; 
  v5 = *((_DWORD *)Process + 272);
  EventData.Ptr = (unsigned __int64)&v5;
  EventData.Reserved = 0;
  EventData.Size = 4;
  v7 = (__int64)Process + 1128;
  v9 = 0;
  v8 = 8;
  if( EtwpHostSiloState != -4516 && (*(_DWORD *)(EtwpHostSiloState + 4524) & 2) != 0 )
  {
    v3 = (EVENT_DESCRIPTOR *)ProcessFreezeEvent;
    if( !Freeze )
      v3 = (EVENT_DESCRIPTOR *)&ProcessThawEvent;
    EtwWrite(*(UINT64 *)EtwpPsProvRegHandle, v3, 0i64, 2ui64, &EventData);
  }
  LODWORD(Flag) = 5249282;
  EtwTraceKernelEvent(&EventData, 1ui64, 0x40000002ui64, 805 - (Freeze != 0), Flag);
}

Referenced by: